jimguys/poemlab — pull request #27 by marclitchfield (2013-09-27 04:47:29+00:00)
Title: Isolate poems and require authentication for line submission

Resolves issues https://github.com/jimguys/poemlab/issues/26 and https://github.com/jimguys/poemlab/issues/16

Add lines route and create endpoint, which adds the line to the database for the authenticated user, then broadcasts to all connected socket.io clients. The event name is poem-specific, so lines only appear in the
poems they are intended for.

Although this does require an authenticated user to submit a poem line, the approach is neither secure nor scalable. Even though the client subscribes to a poem-specific event, all events are still broadcast to all clients, and the traffic can be monitored through browser debugging tools.

Socket.io has a concept called "rooms" that might be worth taking a look at: https://github.com/LearnBoost/socket.io/wiki/Rooms

Since the functionality is a step-forward in terms of functionality and security, and doesn't make the scalability or security any worse, it is probably worth merging in, but we should probably create another issue for the unresolved concerns.